From df4c634d067cf01adca75abb5f38989777c5cddd Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Fri, 27 May 2022 05:12:59 +0800
Subject: vim-patch:8.2.5023: substitute overwrites allocated buffer

Problem:    Substitute overwrites allocated buffer.
Solution:   Disallow undo when in a substitute command.
https://github.com/vim/vim/commit/338f1fc0ee3ca929387448fe464579d6113fa76a
---
 src/nvim/normal.c                    | 36 +++++++++++++++++-------------------
 src/nvim/testdir/test_substitute.vim | 22 ++++++++++++++++++++++
 src/nvim/undo.c                      |  6 ++++++
 3 files changed, 45 insertions(+), 19 deletions(-)

(limited to 'src')

diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 3a552ef053..9696130070 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -432,6 +432,18 @@ static int find_command(int cmdchar)
   return idx;
 }
 
+/// If currently editing a cmdline or text is locked: beep and give an error
+/// message, return true.
+static bool check_text_locked(oparg_T *oap)
+{
+  if (text_locked()) {
+    clearopbeep(oap);
+    text_locked_msg();
+    return true;
+  }
+  return false;
+}
+
 /// Normal state entry point. This is called on:
 ///
 /// - Startup, In this case the function never returns.
@@ -1079,15 +1091,9 @@ static int normal_execute(VimState *state, int key)
     goto finish;
   }
 
-  if (text_locked() && (nv_cmds[s->idx].cmd_flags & NV_NCW)) {
-    // This command is not allowed while editing a cmdline: beep.
-    clearopbeep(&s->oa);
-    text_locked_msg();
-    s->command_finished = true;
-    goto finish;
-  }
-
-  if ((nv_cmds[s->idx].cmd_flags & NV_NCW) && curbuf_locked()) {
+  if ((nv_cmds[s->idx].cmd_flags & NV_NCW)
+      && (check_text_locked(&s->oa) || curbuf_locked())) {
+    // this command is not allowed now
     s->command_finished = true;
     goto finish;
   }
@@ -4704,9 +4710,7 @@ static void nv_gotofile(cmdarg_T *cap)
   char_u *ptr;
   linenr_T lnum = -1;
 
-  if (text_locked()) {
-    clearopbeep(cap->oap);
-    text_locked_msg();
+  if (check_text_locked(cap->oap)) {
     return;
   }
   if (curbuf_locked()) {
@@ -6433,13 +6437,7 @@ static void nv_g_cmd(cmdarg_T *cap)
 
   // "gQ": improved Ex mode
   case 'Q':
-    if (text_locked()) {
-      clearopbeep(cap->oap);
-      text_locked_msg();
-      break;
-    }
-
-    if (!checkclearopq(oap)) {
+    if (!check_text_locked(cap->oap) && !checkclearopq(oap)) {
       do_exmode();
     }
     break;
diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
index bd44079882..e06da3b44f 100644
--- a/src/nvim/testdir/test_substitute.vim
+++ b/src/nvim/testdir/test_substitute.vim
@@ -851,6 +851,28 @@ func Test_sub_change_window()
   delfunc Repl
 endfunc
 
+" This was undoign a change in between computing the length and using it.
+func Do_Test_sub_undo_change()
+  new
+  norm o0000000000000000000000000000000000000000000000000000
+  silent! s/\%')/\=Repl()
+  bwipe!
+endfunc
+
+func Test_sub_undo_change()
+  func Repl()
+    silent! norm g-
+  endfunc
+  call Do_Test_sub_undo_change()
+
+  func! Repl()
+    silent earlier
+  endfunc
+  call Do_Test_sub_undo_change()
+
+  delfunc Repl
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new
diff --git a/src/nvim/undo.c b/src/nvim/undo.c
index 1c0b7aa669..8324db37c6 100644
--- a/src/nvim/undo.c
+++ b/src/nvim/undo.c
@@ -89,6 +89,7 @@
 #include "nvim/change.h"
 #include "nvim/cursor.h"
 #include "nvim/edit.h"
+#include "nvim/ex_getln.h"
 #include "nvim/extmark.h"
 #include "nvim/fileio.h"
 #include "nvim/fold.h"
@@ -1954,6 +1955,11 @@ void undo_time(long step, bool sec, bool file, bool absolute)
   bool above = false;
   bool did_undo = true;
 
+  if (text_locked()) {
+    text_locked_msg();
+    return;
+  }
+
   // First make sure the current undoable change is synced.
   if (curbuf->b_u_synced == false) {
     u_sync(true);
-- 
cgit 


From 0612101c92f7043e47a1b4e80120582ff538c4f8 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 7 Jul 2022 05:37:30 +0800
Subject: vim-patch:8.2.5043: can open a cmdline window from a substitute
 expression

Problem:    Can open a cmdline window from a substitute expression.
Solution:   Disallow opening a command line window when text or buffer is
            locked.
https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d
---
 src/nvim/buffer.c                    |  6 +-----
 src/nvim/ex_getln.c                  | 16 ++++++++++++++++
 src/nvim/testdir/test_substitute.vim | 27 +++++++++++++++++++++++++++
 src/nvim/window.c                    |  6 +-----
 4 files changed, 45 insertions(+), 10 deletions(-)

(limited to 'src')

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 411705cfa3..7e1eae9632 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -1963,11 +1963,7 @@ int buflist_getfile(int n, linenr_T lnum, int options, int forceit)
     return OK;
   }
 
-  if (text_locked()) {
-    text_locked_msg();
-    return FAIL;
-  }
-  if (curbuf_locked()) {
+  if (text_or_buf_locked()) {
     return FAIL;
   }
 
diff --git a/src/nvim/ex_getln.c b/src/nvim/ex_getln.c
index f322c46bf1..51085c4fa0 100644
--- a/src/nvim/ex_getln.c
+++ b/src/nvim/ex_getln.c
@@ -2726,6 +2726,17 @@ char *get_text_locked_msg(void)
   }
 }
 
+/// Check for text, window or buffer locked.
+/// Give an error message and return true if something is locked.
+bool text_or_buf_locked(void)
+{
+  if (text_locked()) {
+    text_locked_msg();
+    return true;
+  }
+  return curbuf_locked();
+}
+
 /// Check if "curbuf->b_ro_locked" or "allbuf_lock" is set and
 /// return true when it is and give an error message.
 bool curbuf_locked(void)
@@ -6600,6 +6611,11 @@ static int open_cmdwin(void)
   bool save_exmode = exmode_active;
   int save_cmdmsg_rl = cmdmsg_rl;
 
+  // Can't do this when text or buffer is locked.
+  if (text_or_buf_locked()) {
+    return K_IGNORE;
+  }
+
   // Can't do this recursively.  Can't do it when typing a password.
   if (cmdwin_type != 0
       || cmdline_star > 0) {
diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
index e06da3b44f..bc1b3fae4b 100644
--- a/src/nvim/testdir/test_substitute.vim
+++ b/src/nvim/testdir/test_substitute.vim
@@ -1,5 +1,7 @@
 " Tests for the substitute (:s) command
 
+source shared.vim
+
 func Test_multiline_subst()
   enew!
   call append(0, ["1 aa",
@@ -873,6 +875,31 @@ func Test_sub_undo_change()
   delfunc Repl
 endfunc
 
+" This was opening a command line window from the expression
+func Test_sub_open_cmdline_win()
+  " the error only happens in a very specific setup, run a new Vim instance to
+  " get a clean starting point.
+  let lines =<< trim [SCRIPT]
+    norm o0000000000000000000000000000000000000000000000000000
+    func Replace()
+      norm q/
+    endfunc
+    s/\%')/\=Replace()
+    redir >Xresult
+    messages
+    redir END
+    qall!
+  [SCRIPT]
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], '-u NONE -S Xscript')
+    let messages = readfile('Xresult')
+    call assert_match('E565: Not allowed to change text or change window', messages[3])
+  endif
+
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
 " Test for the 2-letter and 3-letter :substitute commands
 func Test_substitute_short_cmd()
   new
diff --git a/src/nvim/window.c b/src/nvim/window.c
index ee0d19b1fe..771a85479d 100644
--- a/src/nvim/window.c
+++ b/src/nvim/window.c
@@ -4571,12 +4571,8 @@ void win_goto(win_T *wp)
 {
   win_T *owp = curwin;
 
-  if (text_locked()) {
+  if (text_or_buf_locked()) {
     beep_flush();
-    text_locked_msg();
-    return;
-  }
-  if (curbuf_locked()) {
     return;
   }
 
-- 
cgit 


From d4db87f4932a3a994cd5364c1cf85f0913a37070 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 7 Jul 2022 05:45:52 +0800
Subject: vim-patch:8.2.5044: command line test fails

Problem:    Command line test fails.
Solution:   Also beep when cmdline win can't be opened because of locks.
            Make the test not beep.  Make the test pass on MS-Windows.
https://github.com/vim/vim/commit/be99042b03edf7b8156c9adbc23516bfcf2cec0f
---
 src/nvim/ex_getln.c                  | 7 +------
 src/nvim/testdir/test_substitute.vim | 5 +++--
 2 files changed, 4 insertions(+), 8 deletions(-)

(limited to 'src')

diff --git a/src/nvim/ex_getln.c b/src/nvim/ex_getln.c
index 51085c4fa0..7e22ed55cb 100644
--- a/src/nvim/ex_getln.c
+++ b/src/nvim/ex_getln.c
@@ -6612,13 +6612,8 @@ static int open_cmdwin(void)
   int save_cmdmsg_rl = cmdmsg_rl;
 
   // Can't do this when text or buffer is locked.
-  if (text_or_buf_locked()) {
-    return K_IGNORE;
-  }
-
   // Can't do this recursively.  Can't do it when typing a password.
-  if (cmdwin_type != 0
-      || cmdline_star > 0) {
+  if (text_or_buf_locked() || cmdwin_type != 0 || cmdline_star > 0) {
     beep_flush();
     return K_IGNORE;
   }
diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
index bc1b3fae4b..619b63202a 100644
--- a/src/nvim/testdir/test_substitute.vim
+++ b/src/nvim/testdir/test_substitute.vim
@@ -880,6 +880,7 @@ func Test_sub_open_cmdline_win()
   " the error only happens in a very specific setup, run a new Vim instance to
   " get a clean starting point.
   let lines =<< trim [SCRIPT]
+    set vb t_vb=
     norm o0000000000000000000000000000000000000000000000000000
     func Replace()
       norm q/
@@ -892,8 +893,8 @@ func Test_sub_open_cmdline_win()
   [SCRIPT]
   call writefile(lines, 'Xscript')
   if RunVim([], [], '-u NONE -S Xscript')
-    let messages = readfile('Xresult')
-    call assert_match('E565: Not allowed to change text or change window', messages[3])
+    call assert_match('E565: Not allowed to change text or change window',
+          \ readfile('Xresult')->join('XX'))
   endif
 
   call delete('Xscript')
-- 
cgit